treewide: sanitize various user-provided inputs

2026-07-25 20:46:21 +09:00
parent 30594b62f7
commit ffb8ed0c9d
5 changed files with 17 additions and 14 deletions
@@ -118,8 +118,8 @@ $imageTemplate = '
            '%user'         =>  htmlspecialchars($imguser),
            '%time'         =>  $modTime,
            '%name'         =>  htmlspecialchars($displaypath),
-            '%path'         =>  $serverPath . $value,
-            '%thumbnail'    =>  $serverPath . '/.thumbnails' . $value . '.png',
+            '%path'         =>  htmlspecialchars($serverPath . $value),
+            '%thumbnail'    =>  htmlspecialchars($serverPath . '/.thumbnails' . $value . '.png'),
            '%realname'     =>  htmlspecialchars($realname),
          ];
          echo strtr($imageTemplate, $vars);